mailauth 0.3.0 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 77dfb8831d86e9be13316fe465a7655bf0aedf4da6164cdd0d2c4ab51cb5f6a4
-  data.tar.gz: dd67a9d118d2410deeb00d57f907075c9d77e58637f69b2989ed7c1066e01fd8
+  metadata.gz: 49dfab12d1bcd9e138fd09d613b66d5ffa150cbd4d73ce381e10a07a6aa3e3f2
+  data.tar.gz: 99e7290474ee3fe5054e05b23041cdf93b9f91d174f7d7ed23dd7ded0743b9e1
 SHA512:
-  metadata.gz: 3ebf36b61620326e742d838d3472dc32f8e9fb43812126e27e00daed54e947711167ab42742622432f28344b5ceeeee3d1d2348f1187212a4708c2138a821770
-  data.tar.gz: c35623984649fb47802e1a61386bbb8cdb91f192b2597209d5556ccafba35c97099afc482fa531837d94e54ce29a72131b82f6f25fdb2f19e446bbe03b7effd9
+  metadata.gz: 5381265ba7b84d464781bbca0428c1ceec111b93eea103095545301d381a4b4bfbfc55fb34bf47e5ffd8921700a531bb83d965dc3c3d087739a72452e53a7e3b
+  data.tar.gz: '06093aba36c61e9a818afc9c82749416cee178345136cc3473877d5bc5354dd460189bfa02963d82354e38a4ce168b8a07412421c7b78f7c19cf2d826a8835e5'

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.3.2
+
+- `permerror` rather than `pass` for an `rsa-sha1` signature, retired by RFC 8301 §3.1
+- At most ten DKIM signatures are verified per message
+
+## 0.3.1
+
+- `temperror` when no nameserver is usable, rather than a raise
+- Documentation
+
 ## 0.3.0
 
 **A nameserver failing is no longer read as a domain publishing nothing.** Expect

data/README.md

@@ -1,10 +1,10 @@
 # mailauth
 
-✉️ Email authentication for Ruby
+✉️ Email authentication for Ruby.
 
-**mailauth** verifies SPF, DKIM, DMARC, and ARC on received mail, and signs outgoing mail with DKIM. Pure Ruby, no dependencies beyond `dnsruby`.
+Answers one question about a received message: is it really from who it says it's from?
 
-It answers one question about a message: is it really from who it says it's from?
+**mailauth** verifies SPF, DKIM, DMARC, and ARC on received mail, and signs outgoing mail with DKIM.
 
 ## Features
 
@@ -16,10 +16,22 @@ It answers one question about a message: is it really from who it says it's from
 - ARC verification (RFC 8617), reporting what each hop sealed and left to you to trust
 - Injectable resolver, so tests run against a hash instead of a network
 
-Not planned: MTA-STS (outbound TLS policy, not message auth), `Received-SPF` (Authentication-Results already covers it), `%{p}` (RFC 7208 discourages PTR).
-
 > Not a spam filter.
 
+## Contents
+
+- [Getting Started](#getting-started)
+- [Authentication](#authentication)
+- [Results](#results)
+- [Individual Checks](#individual-checks)
+- [When It Doesn't Pass](#when-it-doesnt-pass)
+- [Resolver](#resolver)
+- [ARC](#arc)
+- [Signing](#signing)
+- [Testing](#testing)
+- [History](#history)
+- [Contributing](#contributing)
+- [License](#license)
 
 ## Getting Started
 
@@ -125,8 +137,6 @@ end
 - `permerror` - the record or signature is broken; retrying changes nothing
 - `none` - the domain published no policy, or the message carried no signature
 
-
-
 ## Resolver
 
 Every lookup goes through one object with five methods - `txt`, `a`, `aaaa`, `mx`, `ptr`:
@@ -137,7 +147,7 @@ MailAuth.authenticate(raw, ip: ip, resolver: MyCachingResolver.new)
 
 Raise `NotFound` for a void lookup (SPF counts these against a limit), `Timeout` or `ServerFailure` for no answer, which produces a `temperror` that stops evaluation. Collapsing those into empty arrays loses a distinction SPF spends much of its rulebook on.
 
-The default resolver uses [dnsruby](https://github.com/alexdalitz/dnsruby) rather than `Resolv`, which collapses SERVFAIL/REFUSED into the same empty answer as NXDOMAIN. It caches nothing and does not validate DNSSEC.
+The default resolver uses [dnsruby](https://github.com/alexdalitz/dnsruby) rather than `Resolv`, which collapses SERVFAIL/REFUSED into the same empty answer as NXDOMAIN.
 
 ## ARC
 
@@ -185,27 +195,19 @@ bundle install
 rake
 ```
 
-SPF runs against the [RFC 7208 test suite](http://www.openspf.org/Test_Suite) - 200 official cases covering every mechanism, the lookup limits, and the error semantics. One case is skipped: `p-macro-multiple`, which needs PTR forward-confirmation this library doesn't do.
-
-DKIM runs against the sample message in RFC 8463 Appendix A, which carries both an RSA and an Ed25519 signature over the same body. Signing is held to the same standard: both algorithms are deterministic, so signing the sample message with its published private keys must reproduce the published signatures byte for byte.
-
-ARC runs against the [ValiMail ARC test suite](https://github.com/ValiMail/arc_test_suite) - 171 cases over chain validation, header structure, tag grammar, and key strength.
-
 ## History
 
-View the changelog
+View the [changelog](CHANGELOG.md).
 
 ## Contributing
 
 Everyone is encouraged to help improve this project:
 
-- [Report bugs](https://github.com/example/mailauth/issues)
+- [Report bugs](https://github.com/mailpiece/mailauth/issues)
 - Fix bugs and submit pull requests
 - Write, clarify, or fix documentation
 - Suggest or add new features
 
-
-
 ## License
 
 MIT. See [LICENSE](LICENSE).

data/lib/mailauth/arc.rb

@@ -44,7 +44,7 @@ module MailAuth
       Dkim.parse_tags(value_of(field).to_s)
     end
 
-    # sha1 is still legal for a DKIM signature and never was for ARC.
+    # RFC 8617 never registered sha1; DKIM's list matches only since retiring it.
     def self.signing_algorithm?(algorithm)
       SIGNING_ALGORITHMS.include?(signing_algorithm(algorithm)) && HASHES.include?(hash_algorithm(algorithm))
     end

data/lib/mailauth/dkim.rb

@@ -17,7 +17,8 @@ module MailAuth
     # the algorithm is unsupported, or the key is unreadable.
     class Malformed < StandardError; end
 
-    HASHES = { "sha1" => OpenSSL::Digest::SHA1, "sha256" => OpenSSL::Digest::SHA256 }.freeze
+    # RFC 8301 §3.1 retired rsa-sha1: a verifier must not consider one valid.
+    HASHES = { "sha256" => OpenSSL::Digest::SHA256 }.freeze
     SIGNING_ALGORITHMS = %w[ rsa ed25519 ].freeze
 
     # What OpenSSL calls a key, mapped to what a= calls it.
@@ -29,6 +30,10 @@ module MailAuth
     # RFC 6376 §3.2: ALPHA *ALNUMPUNC.
     TAG_NAME = /\A[a-zA-Z][a-zA-Z0-9_]*\z/n
 
+    # RFC 6376 §8.4. Each signature costs a lookup for a key its sender named,
+    # and headers are cheap to write, so only the first so many are answered.
+    MAXIMUM_SIGNATURES = 10
+
     # Shorter RSA keys are factorable cheaply enough to prove nothing.
     MINIMUM_RSA_BITS = 1024
 
@@ -37,10 +42,20 @@ module MailAuth
     ED25519_SPKI_PREFIX = [ "302a300506032b6570032100" ].pack("H*")
 
     def self.verify(message, resolver: Resolver.new, now: Time.now)
-      signatures = message.fields_named("dkim-signature").map do |field|
+      fields = message.fields_named("dkim-signature")
+
+      signatures = fields.first(MAXIMUM_SIGNATURES).map do |field|
         Verification.new(message, field, resolver:, now:).result
       end
-      signatures << Signature.new(status: Status::NONE, comment: "message not signed") if signatures.empty?
+
+      # The ones left over are reported rather than dropped: a verifier that
+      # quietly ignores a signature says a message carried fewer than it did.
+      if fields.empty?
+        signatures << Signature.new(status: Status::NONE, comment: "message not signed")
+      elsif fields.length > MAXIMUM_SIGNATURES
+        signatures << Signature.new(status: Status::PERMERROR,
+          comment: "#{fields.length - MAXIMUM_SIGNATURES} more signatures not evaluated")
+      end
 
       DkimResult.new(signatures:)
     end

data/lib/mailauth/resolver.rb

@@ -82,6 +82,9 @@ module MailAuth
           dns.do_caching = false
           dns.query_timeout = @timeout
         end
+      rescue ArgumentError => error
+        # Dnsruby raises this when no configured nameserver is usable.
+        raise ServerFailure, "no usable nameserver: #{error.message}"
       end
 
       # Override in tests to point at a loopback nameserver.

data/lib/mailauth/version.rb

@@ -1,3 +1,3 @@
 module MailAuth
-  VERSION = "0.3.0"
+  VERSION = "0.3.2"
 end

data/mailauth.gemspec

@@ -7,10 +7,9 @@ Gem::Specification.new do |spec|
   spec.platform = Gem::Platform::RUBY
   spec.required_ruby_version = ">= 3.3.4"
   spec.authors = [ "Simon Lev" ]
-  spec.email = [ "support@postrider.dev" ]
 
-  spec.summary = "SPF, DKIM, DMARC, and ARC verification for received mail, in pure Ruby."
-  spec.description = "Answers one question about a received message: is it really from who it says it's from?"
+  spec.summary = "Email authentication for Ruby."
+  spec.description = "Answers one question about a received message: is it really from who it says it's from? Implements DKIM signing and verification, SPF, DMARC, and ARC."
 
   spec.homepage = "https://github.com/mailpiece/mailauth"
   spec.license = "MIT"
@@ -33,7 +32,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = [ "lib" ]
 
   # Resolv collapses SERVFAIL/REFUSED into empty answers; dnsruby does not.
-  spec.add_dependency "dnsruby", "~> 1.72"
+  spec.add_dependency "dnsruby", "~> 1.74"
   spec.add_dependency "public_suffix", ">= 5.0"
   spec.add_dependency "simpleidn", "~> 0.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mailauth
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.2
 platform: ruby
 authors:
 - Simon Lev
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.72'
+        version: '1.74'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.72'
+        version: '1.74'
 - !ruby/object:Gem::Dependency
   name: public_suffix
   requirement: !ruby/object:Gem::Requirement
@@ -52,9 +52,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0.2'
 description: 'Answers one question about a received message: is it really from who
-  it says it''s from?'
-email:
-- support@postrider.dev
+  it says it''s from? Implements DKIM signing and verification, SPF, DMARC, and ARC.'
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -112,5 +110,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 4.0.3
 specification_version: 4
-summary: SPF, DKIM, DMARC, and ARC verification for received mail, in pure Ruby.
+summary: Email authentication for Ruby.
 test_files: []